Southern Company is notifying approximately 400,000 customers through its online customer portal that an unauthorized third party has accessed their utility account information.
The Atlanta-based energy holding company serves more than 9 million customers through electric utilities in three states and natural gas distribution companies in four states. Its electric subsidiaries are Georgia Power, Alabama Power and Mississippi Power.
About 300,000 of the affected accounts belong to Georgia Power customers. Southern Company said the incident also affected approximately 100,000 of Alabama Power’s 1.6 million accounts.
Mississippi Power is named as affected in the company’s public announcement, but no figures for its customers were released.
“An unauthorized third party accessed certain, limited information about the accounts of approximately 400,000 customers. Upon discovery, we took immediate action to stop the activity and involved law enforcement,” the company said in a statement sent to media.
Southern Company Public Announcement indicates the type of data involved. “Based on our investigation to date, the limited customer account information accessed by the unauthorized party includes the customer’s name, mailing address, telephone number, email address or the last four digits of their Social Security number, and other basic account information,” the notice said.
The utility states that the attacker did not access bank account numbers, payment card numbers, or driver’s license numbers.
Southern Company has not said when the break-in occurred or how the attacker gained access to the portal.
Affected customers will be notified by mail and email and will receive one year of free credit monitoring.
Related: ASOS confirms cyberattack and data breach
Related: Advantest announces data breach months after ransomware attack
Related: 8.8 million people affected by data breach in Denmark’s central register of people
Related: Personal information of over 1 million people stolen in a cyberattack on Arizona’s court system
